Re: [Qemu-devel] [PATCH 6/9] usb: mtp: fix possible buffer overflow

[Peter Wu]

On Friday 25 April 2014 12:48:11 Gerd Hoffmann wrote:
> Signed-off-by: Gerd Hoffmann <address@hidden>
> ---
>  hw/usb/dev-mtp.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
> index 45f9562..82d5b64 100644
> --- a/hw/usb/dev-mtp.c
> +++ b/hw/usb/dev-mtp.c
> @@ -998,6 +998,9 @@ static void usb_mtp_handle_data(USBDevice *dev,
> USBPacket *p) cmd.argc = (le32_to_cpu(container.length) -
> sizeof(container)) / sizeof(uint32_t);
>              cmd.trans = le32_to_cpu(container.trans);
> +            if (cmd.argc > ARRAY_SIZE(cmd.argv)) {
> +                cmd.argc = ARRAY_SIZE(cmd.argv);
> +            }

This is not sufficient, you must also check that the iov is large enough to 
hold this many args.

Kind regards,
Peter

>              usb_packet_copy(p, &params, cmd.argc * sizeof(uint32_t));
>              for (i = 0; i < cmd.argc; i++) {
>                  cmd.argv[i] = le32_to_cpu(params[i]);